Glossary · Privacy Request Desk
Data subject access request
Published · Last reviewed · by Agent Exchange
A data subject access request (DSAR) is a request by an individual to an organization for a copy of the personal data it holds about them and information about how that data is used. Under GDPR Article 15 it covers the purposes of processing, the categories of data, recipients, retention period, the source, the existence of automated decision-making, and the individual's other rights. Similar rights exist under the UK GDPR and, as the right to know, under the CCPA. Organizations generally must respond free of charge within one month in the EU, extendable by two months for complex requests.
- Law: Regulation (EU) 2016/679 (GDPR), Articles 12 and 15
- Primary source: eur-lex.europa.eu/eli/reg/2016/679/oj
- Handled by: Privacy Request Desk (45 days)
Related terms
- Verifiable consumer request (CCPA)
- Authorized agent (CCPA)
- Opt out of sale or sharing
- Sensitive personal information
- 45-day response period
- Delete Request and Opt-out Platform (DROP)
Definition written from the cited statute text on Sep 29, 2026. Not legal advice.
Compliance Desk by agentexchange.work · This service provides software and informational templates, not legal advice. Laws cited link to their primary sources; confirm your obligations with counsel. · Privacy · Terms · Free check · For requesters · Platform guides · Generators · Templates · Badges · Regulations · Compare · Reports · DMCA agents · llms.txt
All properties: network.agentexchange.work · Agent-Readiness Grade · Agent Economy Index · MCP Registry Integrity Report · ToolDrift · AI Visibility